Privacy Policy

1. Overview of Data Protection

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any data that can personally identify you. Detailed information on data protection can be found in the privacy policy below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the section “Information about the Data Controller” below.

How do we collect your data?

Some data are collected when you provide them to us — for example, data you enter into a contact form.

Other data are collected automatically or after your consent when you visit the website. These are mainly technical data (e.g., browser type, operating system, time of access). This data is collected automatically as soon as you enter the website.

What do we use your data for?

Some of the data are collected to ensure the proper functioning of the website. Other data may be used to analyze user behavior.

What rights do you have regarding your data?

You have the right to request information, free of charge, about the origin, recipient, and purpose of your stored personal data at any time. You also have the right to request correction or deletion of these data. If you have given consent to data processing, you may revoke this consent at any time for the future. You also have the right, under certain circumstances, to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time with questions about data protection.

Analytics and Third-Party Tools

On selected landing pages, we use analytics and marketing services for reach measurement and advertising success measurement. These services are loaded only after your consent via the cookie banner.

We use Google Analytics 4 (with IP anonymization) and the Meta Pixel on those pages. Providers may process usage data, device information, IP addresses, referrers, access times, and cookie or pixel identifiers. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future.

Reach statistics for public marketing pages

To assess the reach of 42 specified public marketing pages, we use the access logs already generated by our hosting provider, All-Inkl. A daily server-side process counts successful page requests, assigns the requested page and referrer to fixed categories, and aggregates the requests by UTC calendar day. Known bots are excluded using the User-Agent. Requests not identified as bots are not verified human visits; we do not determine unique visitors.

These statistics make no additional request from your browser, set no statistics cookies, and create no visitor identifier. The aggregate statistics table contains only the UTC day, fixed page and source categories, and a count. It does not store individual requests, IP addresses, complete URLs or referrers, or User-Agents. The underlying access logs may nevertheless contain IP addresses, full requests including query parameters, referrers, and User-Agents. They remain separate hosting logs with their own retention rules; the 13-month period does not apply to those raw logs or backups.

We retain the aggregate daily counts for 13 months. Expired days are deleted during the daily import; if a run fails, cleanup takes place at the next successful run. Art. 6 (1) (f) GDPR is the intended legal basis for this statistical use of existing logs. Our interest is to understand the reach and use of our public information pages and improve them accordingly. Fixed daily categories suffice for this purpose; recognizing individuals is unnecessary. To limit the impact on visitors, we restrict the analysis to those categories, exclude known bots, and store no individual statistics events. The final legal assessment of this balancing of interests is still pending.

These statistics are separate from the internal app reach statistics, which have a 30-day retention period, and from Google Analytics 4 and the Meta Pixel. Daily counts are not sent to those external analytics services.

Internal App Reach Statistics

When certain metacards app entry pages are opened, we count page views to evaluate use of the app in broad categories. We store the time, a fixed category for the app entry point or language version, a broad source category, and a flag for known bots or automated requests. The browser may derive the source category from selected campaign parameters or the referring site. Their actual values are not sent or stored in the current pageview statistics.

The current statistics request sends neither cookies nor a Referer header. These statistics set no cookies of their own, store no data in LocalStorage or SessionStorage, and create no visitor identifier. New pageview entries contain no IP address, complete URL path or query parameters, and no UTM, referrer, country, device, or browser values. The User-Agent is used only to classify automated requests and is not stored in the pageview statistics. The IP address and technical headers are nevertheless processed during transmission and by the hosting provider independently of these statistics; the hosting and server log sections provide further information.

Internal app reach statistics are automatically cleaned up daily. Records older than 30 days are deleted. Because cleanup runs once per day, actual retention may slightly exceed 30 days. Server logs and backups are subject to separate rules.

The internal app statistics are separate from Google Analytics 4 and the Meta Pixel. Their pageview data are not shared with those external services.

2. Hosting

Our website content is hosted by the following provider:

All-Inkl

Provider: ALL-INKL.COM – Neue Medien Münnich, Owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hereinafter “All-Inkl”). Details can be found in the All-Inkl Privacy Policy: https://all-inkl.com/datenschutzinformationen/.

The use of All-Inkl is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in providing our website as reliably as possible. If consent has been requested, processing will be based exclusively on Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, as far as the consent covers storage of cookies or access to information on the user’s device (e.g., device fingerprinting). Consent may be revoked at any time.

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We handle your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data by which you can be personally identified. This privacy policy explains what data we collect and what we use them for. It also explains how and for what purpose this happens.

Please note that data transmission over the Internet (e.g., communication by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the Data Controller

The data controller for this website is:

Enrico Schättin
Friedensstraße 18
09328 Lunzenau
Germany
E-mail: support@metacards.net

The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g., names, e-mail addresses, etc.).

Storage Period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you request deletion or withdraw your consent, your data will be deleted unless we are legally required to retain them (e.g., tax or commercial retention periods).

Legal Basis for Data Processing

If you have given consent, we process your data based on Art. 6 (1) (a) GDPR or, if special categories of data under Art. 9 (1) GDPR are processed, Art. 9 (2) (a) GDPR. If explicit consent has been given for the transfer of data to third countries, processing is also based on Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or access to device information, processing is additionally based on § 25 (1) TDDDG. Consent can be revoked at any time. If your data is necessary for contract fulfillment or pre-contractual measures, we process it under Art. 6 (1) (b) GDPR. We may also process data under Art. 6 (1) (c) GDPR (legal obligation) or Art. 6 (1) (f) GDPR (legitimate interest). Details are provided in the sections below.

Recipients of Personal Data

We cooperate with various external parties in the course of our business activities. In some cases, the transfer of personal data to these third parties is necessary. We only share personal data with third parties when it is required for contractual purposes, when legally obligated (e.g., tax authorities), when we have a legitimate interest (Art. 6 (1) (f) GDPR), or when another legal basis allows the transfer. In the case of data processors, data is transferred only based on a valid data processing agreement in accordance with Art. 28 GDPR.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may revoke your consent at any time. The legality of data processing carried out before revocation remains unaffected.

Right to Object under Art. 21 GDPR

If processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object at any time for reasons arising from your particular situation. This also applies to profiling based on these provisions. If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing.

Right to Lodge a Complaint

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the lock icon in your browser bar. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

4. Data Collection on This Website

Registration and User Account

If you create a user account on metacards.net, we store the data you provide (e.g., e-mail address, name, login credentials) exclusively to enable access to account-based functions. Processing is based on Art. 6 (1) (b) GDPR (contract fulfillment) or your consent (Art. 6 (1) (a) GDPR). The data will be deleted once you delete your account or withdraw your consent, provided no legal obligations prevent deletion.

Use of Personal Data in Interactive Tools

When using the coaching tools on metacards.net (e.g., card decks, systemic boards, values tools), your inputs are processed temporarily to provide the service functionality. These data are only used for the current session and are not permanently stored unless you explicitly save them to your profile. In that case, storage is based on your consent (Art. 6 (1) (a) GDPR), and you can delete saved content at any time.

Cookies

Our website uses so-called “cookies.” Cookies are small data packets that do no harm to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently until deleted. Session cookies are automatically deleted after you leave the site. Permanent cookies remain until you delete them manually or your browser deletes them automatically.

Server Log Files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include browser type and version, operating system, referrer URL, hostname of the accessing device, time of the server request, and IP address.

Inquiries by E-mail or Phone

If you contact us by e-mail or phone, your inquiry, including all resulting personal data (name, request), is stored and processed for the purpose of handling your request. We do not share this data without your consent.

Data Processing Agreement

We have concluded data processing agreements (Art. 28 GDPR) with all external service providers who process personal data on our behalf (e.g., hosting providers, analytics services) to ensure data protection. If you use metacards.net as a coach to process your clients’ personal data, you are required to conclude a Data Processing Agreement (DPA) with us, which can be requested anytime via support@metacards.net.

5. Newsletter

Newsletter Data

If you would like to receive the newsletter offered on the website, we require an e-mail address and information that allows us to verify that you are the owner of the provided e-mail address and that you agree to receive the newsletter. No additional data are collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not share it with third parties.

The processing of the data entered into the newsletter registration form is based exclusively on your consent (Art. 6 (1) (a) GDPR). You can revoke your consent at any time, for example via the “unsubscribe” link in the newsletter. The legality of processing carried out before the revocation remains unaffected.

Last updated: May 2026